Look at this ATT&CK entry:
T1059.001 — Command and Scripting Interpreter: PowerShell
Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.
That’s a lot packed into one ID. T1059.001 is actually three layers of specificity compressed into a dot-notation string. Pull it apart and you have the entire ATT&CK hierarchy.
The 14 Tactics — “Why”
A Tactic is the adversary’s objective for a given action. Tactics answer “why?”
ATT&CK Enterprise has exactly 14 tactics:
| ID | Tactic | What the adversary wants |
|---|---|---|
| TA0043 | Reconnaissance | Gather information before attacking |
| TA0042 | Resource Development | Build attack infrastructure |
| TA0001 | Initial Access | Get a foothold in the environment |
| TA0002 | Execution | Run adversary-controlled code |
| TA0003 | Persistence | Maintain access through reboots/credential changes |
| TA0004 | Privilege Escalation | Get higher permissions |
| TA0005 | Defense Evasion | Avoid detection |
| TA0006 | Credential Access | Steal credentials |
| TA0007 | Discovery | Learn about the environment |
| TA0008 | Lateral Movement | Move through the environment |
| TA0009 | Collection | Gather data of interest |
| TA0011 | Command and Control | Communicate with compromised systems |
| TA0010 | Exfiltration | Get data out |
| TA0040 | Impact | Disrupt, destroy, manipulate |
Techniques — “How”
A Technique describes how an adversary achieves a tactic. Techniques answer “how?”
Every technique has a T#### ID. Example: T1059 — Command and Scripting Interpreter.
This technique lives under the Execution tactic. An adversary using T1059 is running code through some kind of interpreter — could be PowerShell, bash, Python, cmd.exe, or a custom scripting environment.
A single technique often appears under multiple tactics. T1078 — Valid Accounts is listed under Initial Access, Persistence, Privilege Escalation, and Defense Evasion — because using a stolen credential serves all four objectives depending on context.
Sub-techniques — “Specifically How”
A Sub-technique drills into a specific variation of a technique. Sub-techniques use dot-notation: T####.###.
| Technique | Sub-technique | ID |
|---|---|---|
| Command and Scripting Interpreter | PowerShell | T1059.001 |
| Command and Scripting Interpreter | Windows Command Shell | T1059.003 |
| Command and Scripting Interpreter | Python | T1059.006 |
| Phishing | Spearphishing Attachment | T1566.001 |
| Phishing | Spearphishing Link | T1566.002 |
Not every technique has sub-techniques. When there’s only one meaningful way to execute a technique, sub-techniques aren’t needed.
Procedures — The Adversary Fingerprint
A Procedure is the specific implementation used by a real threat actor. Procedures are documented instances of a technique or sub-technique in the wild.
Example procedures for T1059.001:
APT32 used PowerShell-based payloads including the PowerShell Empire framework.
FIN7 executed PowerShell scripts from the
%TEMP%directory to download additional payloads.
Lazarus Group used encoded PowerShell commands to evade detection.
Procedures are the most specific layer. They’re the “fingerprints” that attribution analysts use to cluster activity. If two intrusions use the same unique PowerShell obfuscation pattern, that’s a procedure-level overlap — strong evidence of the same threat actor.
Reading an ATT&CK ID
When you see T1059.001, you now know:
T= this is a Technique (not a tactic, data component, or mitigation)1059= the parent technique number (Command and Scripting Interpreter).001= sub-technique number 001 within that parent (PowerShell)
Group IDs use G#### (e.g., G0016 = APT29). Software IDs use S#### (e.g., S0194 = PowerSploit). Campaign IDs use C####.